The California Consumer Privacy Act is a catalyst for strict data privacy standards in the US. Imagine it as a protective fence around the Californian personal information that businesses handle. Whether you are a start-up or a global company, CCPA is something that you cannot overlook. Keep on reading if you are looking for a self-help guide on how to comply with CCPA.
What is CCPA?
The California Consumer Privacy Act (CCPA) is the data privacy legislation that all covered entities must comply with while handling the personal data of California residents. The law promotes transparency between businesses and customers by requiring them to notify customers about the personal data use. Moreover, it authorises consumers with privacy rights such as the right to know, correct, delete, and non-discrimination.
Though not a direct equivalent to the General Data Protection Regulation (GDPR), both laws drive towards ensuring a consumer-friendly data handling approach. Yet, both GDPR and CCPA are different in some aspects.
Non-compliance with CCPA requirements could be a financial drain for your business as fines can go up as high as $7500 per violation. The enforcement of CCPA is carried out by the California Privacy Protection Agency (CPPA) and the Attorney General of California. The law also grants a limited private right of action to consumers in case of data breaches.
Who does CCPA apply to?
The CCPA regulations apply to for-profit businesses in California that collect consumer personal data and meet any of the following thresholds:
- Annual gross revenue is more than $25 Million
- Buy/sell/share personal information of more than 100,000 Californians
- 50% or more of its annual revenue is derived from the sale of personal information
Personal information means any information that can directly or indirectly identify an individual including names, email addresses, geolocation, driver’s license numbers and online identifiers such as cookies and IP addresses.
What are some of the requirements of CCPA?
The CCPA, one of the pioneering data privacy laws regulates personal data use by businesses. The law underwent amendments by the California Privacy Rights Act (CPRA) in 2023.
Businesses that satisfy any of the CCPA thresholds must make sure to comply with the CCPA regulations. Below are a few of the crucial responsibilities that businesses must follow.
- Provide a clear and easy-to-understand privacy policy/privacy notice conspicuously
- Limit the data collection and its use to what is necessary and reasonable
- Provide a “Do not sell or share my information” and “limit the use of my sensitive personal information” link conspicuously
- Obtain opt-in consent for the sale of personal information of children under 16 years of age
- Implement reasonable and necessary security measures to protect the confidentiality of personal information
- Provide easy mechanisms for consumers to exercise their consumer rights
- Honour the consumer rights promptly
- Have a contract with third parties or service providers to ensure their CCPA compliance along with yours
5 key steps to ensure CCPA compliance
CCPA compliance may sound heavy for many businesses as it is a multi-faceted endeavour. However, there are businesses that have successfully conquered these challenges by implementing carefully crafted strategies.
Here are the top 5 steps to begin the CCPA compliance journey for your business.
#1 Conduct a data inventory
Data inventory is the cornerstone of any privacy program. It involves the mapping of data flow within one’s organisation, the categories of consumer data that the business handles and more.
The following steps are pivotal for effective data management:
- Identify the sources and categories of personal information your business collects, including sensitive personal information
- Recognise the flow of data within your organisation, who has access to them, and the data retention period
- Keep track of the data that is shared or sold with others
- Establish and define a reasonable data retention period
- Review and update the inventory regularly
#2 Provide CCPA notices
Transparency builds trust with customers which is essential for CCPA-compliance. Therefore assess and review whether you have a privacy policy/privacy notice and notice at collection in place. Ensure that they are updated and contain all the necessary information as the law prescribes.
As a responsible business that cares about the privacy of your customers, you must publish the CCPA notices conspicuously. The following are the significant CCPA notices.
Privacy policy
A privacy policy informs consumers of an organisation’s data practices. It explains in detail the categories of personal data collected, the purposes for which the business uses it, with who they share it, and how consumers can exercise their consumer rights.
In addition to providing a privacy policy, you must also update privacy policies regularly or whenever there is a change in your organisation’s data practices.
Notice at Collection
A notice at collection provides the list of personal data collected, the specific purposes, consumer rights, etc. It should be given at the time or before the point of collection.
Unlike a privacy policy, a notice at collection is shorter and less descriptive. If your business sells personal information, it must also include a “do not sell or share my personal information” link.
While these are the two foundational notices under CCPA, the law also specifies other disclosures such as the notice of the right to opt out of sale, the notice of the right to limit the use of sensitive personal information and the notice of financial incentive.
#3 Honour consumer rights
The California privacy law encourages consumers to have autonomy over their personal information. To accomplish this, the CCPA grants them certain rights.
Businesses must take appropriate steps to ensure that they provide convenient and easy ways to exercise consumer/data subject rights. Some of the consumer request mechanisms include an active email address, toll-free phone number, and dedicated web forms.
Note that, businesses are generally not allowed to make consumers create a new account just to exercise their consumer rights.
Whenever a consumer exercises their rights such as deletion or correction, ensure to respond to them promptly within 45 days. The response period can be extended to another 45 days if the businesses find it necessary.
Here are some actionable steps to comply with the consumer request requirements:
- Understand the rights of the consumers
- Maintain an active consumer request mechanism and inform about it to the consumers through CCPA notices
- Allocate resources to respond to consumer requests effectively
- Streamline the consumer request management process and train employees on their part
Right to know: Consumers have the right to ask businesses to reveal details about their data handling practices.
Right to delete: This right enables consumers to prevent entities from handling their personal data by requesting them to delete their data from the organisation’s as well as their service providers’ database.
Right to opt-out: CCPA allows consumers to opt out of the sale of personal information.
Right to limit: Consumers can also direct businesses to limit the use of their sensitive personal information for the specific purpose of collection.
Right to correct: Consumers can request to correct any inaccuracies in their personal data handled by businesses.
#4 Provide opt-out links: Do not sell & Limit the use of sensitive information
The CCPA follows an opt-out approach and mandates two opt-out links namely “Do not sell/share my personal information” and “Limit the use of my sensitive personal information”.
Here is an action plan to help you comply with the opt-out requirements.
- Determine whether you sell or disclose consumers’ personal information to third parties or collect sensitive personal information
- Provide a conspicuous “Do not sell or share personal information” and “Limit the use of my sensitive personal information” link conspicuously on your website
- The opt-out process must be easy and convenient
- Recognise global opt-out signals from consumers
#5 Implement data security measures
Fortify your cybersecurity measures by implementing reasonable security measures. This includes using strong passwords, enabling two-factor authentication, and conducting regular backups.
The level of security measures implemented should correspond to the types of data involved. For instance, more stringent security measures are necessary for highly sensitive personal information like social security numbers or exact geolocation data.
In addition to the above measures, it is recommended to give your employees regular training on cybersecurity.
How to implement CCPA compliance with tech?
Achieving compliance with the California Consumer Privacy Act is not only a legal obligation but also a strategic imperative that can foster customer trust, enhance brand reputation and mitigate risks.
Meeting the CCPA standards can sometimes turn out to be a complex and long process, especially for businesses with a large number of customers and multiple websites. However, it is not impossible to become CCPA-compliant. Fortunately, there are software that can simplify the process.
Data discovery and inventory management
Maintaining a channelled data mapping system is crucial for CCPA compliance. You may utilise data mapping softwares to keep track of the customer data you collect and categorise them based on the sensitivity levels and prioritisation requirements.
You may consider different aspects such as budget, user-friendliness of the interface, functionality, scalability and integration capabilities while choosing the suitable tool for your business.
Tools like Skyvia, Ketch and Data Grail are some of the data mapping tools in the market.
Consent management
A consent management platform (CMP) is a valuable tool for businesses to comply with data privacy laws like CCPA. The law requires businesses to give consumers the option to opt out of data sales. This rule applies to websites with visitors from California utilizing third-party cookies.
To comply with the requirements, you must conspicuously provide opt-out links while managing and updating users’ consent preferences.
A CMP such as CookieYes automates the process, has customisable features and saves you time. Once integrated, you can customise the opt-out banner to geolocate Californians and deploy it accordingly. CookieYes simplifies the consent management process and prioritises privacy law compliance.
Automate your consent management
Focus on your growth while we focus on your CCPA compliance
Sign up for your free trial14-day free trialCancel anytime
When selecting a fitting CMP for your business, you may take into account different aspects like features, adherence to regulations, feedback from customers, ease of use and integration, customer support options, and costs.
Look what our customers have to say about CookieYes.
Privacy policy generators
Businesses need to be transparent about their data practices to comply with CCPA. As a result, they are required to write privacy policies that accurately represent how they handle consumer data.
While it is possible to create a privacy policy in-house, many businesses find it easier to use software tools. They are speedy, convenient, efficient and customisable.
The CookieYes privacy policy generator comes with a flexible pre-built template that lets you personalise your privacy policy to suit your specific requirements. It is free of charge. All you need to do is simply answer a few quick questions.
Data subject request management
Handling consumer/ data subject requests might be time-consuming and complicated. Almost all privacy regulations require businesses to provide portals to exercise their privacy rights and promptly fulfil such requests.
The good news is that there are tools to streamline the process effectively. DSR tools like DataGrail and MineOS are some of the DSR tools that you can use to manage privacy requests.
Security software
CCPA makes you responsible for the security of the personal information you handle. To comply with the security obligations, you must implement reasonable cybersecurity measures including password protection, risk assessments, authentication, data masking, and data backups.
Security tools such as Drata, IBM Guardian Insights, and UpGuard are a few examples.
How to stay updated with regular compliance updates?
Given the constantly changing privacy regulations, it is essential to stay current with the latest developments. This means that businesses must be proactive in tailoring their compliance strategies with any updates in the law.
Let us discover some of the strategies that you may use to stay updated.
Legal consultation
Seek the help of privacy professionals or appoint an in-house officer to monitor your business’s compliance.
Follow regulatory bodies
You can also follow regulatory bodies such as the California Attorney General or the CPPA, subscribe to their newsletters or utilise the resources available on their websites.
Industry associations
It is important to recognize that businesses may encounter similar compliance challenges. Engaging with industry associations and establishing connections with them can provide valuable insights and, occasionally, effective solutions for these challenges.
Utilise compliance tools
Select compliance solutions like CookieYes that take a proactive approach to fulfilling privacy regulations and consistently update themselves with the latest legal developments.
Monitoring and ongoing compliance
CCPA compliance is an ongoing process. Therefore, monitoring and ongoing compliance serve as vigilant guardians of your organisation’s reputation.
The following are some focus points that can help.
- Regularly assess compliance efforts to determine their effectiveness and identify any necessary changes
- Ensure CCPA compliance of your service providers or third parties with whom you share personal information
- Keep yourself informed about any changes in the law
- Conduct periodic training sessions for your employees
FAQ on CCPA compliance
Follow these key steps to comply with CCPA:
1. Practice data minimisation and purpose limitation
2. Implement opt-out links
3. Provide an easy-to-understand privacy policy conspicuously
4. Establish convenient consumer request mechanisms
5. Respond to consumer requests within 45 days. If necessary, this period can be extended to 90 days
6. Fortify the security measures to protect the personal data from unauthorised access and data breaches
7. Have a contractual relationship with third parties and ensure their compliance
8. Leverage CMPs to manage and record users’ consent preferences
CCPA mainly applies to for-profit businesses and generally exempts nonprofits from its scope.
CCPA prescribes non-compliance fines ranging from $2500 to $7500 for a single violation. There is no cookie-cutter approach to determining the exact fines as it varies case-by-case.
The fine might seem low compared to the European Union’s General Data Protection Regulation (GDPR), but it can reach millions of dollars based on many factors.
The ultimate penalty is influenced by various factors including the severity and nature of the violation, frequency, the number of people affected, the efforts made by businesses to comply, and the company’s size and revenue.
CCPA mandates covered businesses to disclose whether they sell or share consumer data with third parties and collect sensitive data. If they do, these businesses are also required to provide “Do not sell or share my personal information” and “limit the use of my sensitive personal information” links on their websites. They are commonly known as opt-out links.
The opt-out links should work properly and be easy to use. After a user opts out using the link, you should cease selling or sharing their personal data, or restrict the use of sensitive data to essential purposes as per the user’s instructions.
Though CCPA takes an opt-out approach for data sales, opt-in consent is necessary for the sale of personal information of children below 16 years of age.
Safna Y Yacoob is a data privacy writer at CookieYes with a law degree and certifications in the field. Dedicated to simplifying complex legalese, she stays current with data privacy trends through continuous learning.
